```

refactor(core): 重构核心模块结构并更新导入路径

- 将配置相关的设置从 app.core.config 移除
- 将常量定义从 app.core.constants 移除
- 将数据库相关功能从 app.core.database 移除
- 将基础数据库模型从 app.core.db_base 移除
- 将敏感信息掩码功能从 app.core.masking 移除
- 将中间件定义从 app.core.middleware 移除
- 将操作保护功能从 app.core.operation_guard 移除
- 将分页工具从 app.core.pagination 移除
- 将请求上下文管理从 app.core.request_context 移除
- 将调度器功能从 app.core.scheduler 移除
- 将安全认证逻辑从 app.core.security 移除
- 将任务队列相关功能从 app.core.task_queue 移除
- 将时间工具从 app.core.time 移除
- 更新 alembic 配置中的 Base 模型导入路径
- 更新各模块中对重构后组件的引用路径
```

app/core/security/__init__.py

@@ -0,0 +1,13 @@
+from app.core.security.api_keys import ApiPrincipal, require_api_key, require_audit_api_key
+from app.core.security.operation_guard import (
+    READ_ONLY_OPERATION_DISABLED,
+    require_operations_enabled,
+)
+
+__all__ = [
+    "ApiPrincipal",
+    "READ_ONLY_OPERATION_DISABLED",
+    "require_api_key",
+    "require_audit_api_key",
+    "require_operations_enabled",
+]

app/core/security/api_keys.py

@@ -0,0 +1,98 @@
+from dataclasses import dataclass
+from secrets import compare_digest
+from typing import Any
+
+from fastapi import Header, HTTPException, status
+
+from app.core.config import get_settings
+from app.core.constants import HttpHeader, SecurityErrorDetail
+
+
+@dataclass(frozen=True)
+class ApiPrincipal:
+    """Authenticated service principal derived from server-side configuration."""
+
+    actor: str
+
+
+def require_api_key(
+    x_api_key: str | None = Header(default=None, alias=HttpHeader.X_API_KEY),
+) -> ApiPrincipal:
+    """Validate the internal API key header and return its service principal."""
+
+    settings = get_settings()
+    if not settings.api_key and not _has_enabled_keys(settings.api_keys):
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail=SecurityErrorDetail.API_KEY_REQUIRED,
+        )
+    principal = _match_service_key(
+        x_api_key,
+        settings.api_key,
+        settings.api_actor,
+        settings.api_keys,
+    )
+    if principal is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=SecurityErrorDetail.INVALID_API_KEY,
+        )
+    return principal
+
+
+def require_audit_api_key(
+    x_audit_api_key: str | None = Header(
+        default=None,
+        alias=HttpHeader.X_AUDIT_API_KEY,
+    ),
+) -> ApiPrincipal:
+    """Validate the audit API key and return the audit principal."""
+
+    settings = get_settings()
+    if not settings.audit_api_key and not _has_enabled_keys(settings.audit_api_keys):
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail=SecurityErrorDetail.AUDIT_API_KEY_REQUIRED,
+        )
+    principal = _match_service_key(
+        x_audit_api_key,
+        settings.audit_api_key,
+        settings.audit_api_actor,
+        settings.audit_api_keys,
+    )
+    if principal is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=SecurityErrorDetail.INVALID_AUDIT_API_KEY,
+        )
+    return principal
+
+
+def _has_enabled_keys(configured_keys: list[dict[str, Any]]) -> bool:
+    return any(_key_enabled(item) and item.get("key") for item in configured_keys)
+
+
+def _match_service_key(
+    provided_key: str | None,
+    legacy_key: str | None,
+    legacy_actor: str,
+    configured_keys: list[dict[str, Any]],
+) -> ApiPrincipal | None:
+    if not provided_key:
+        return None
+    if legacy_key and compare_digest(provided_key, legacy_key):
+        return ApiPrincipal(actor=legacy_actor)
+    for item in configured_keys:
+        key = item.get("key")
+        if not key or not _key_enabled(item):
+            continue
+        if compare_digest(provided_key, str(key)):
+            return ApiPrincipal(actor=str(item.get("actor") or legacy_actor))
+    return None
+
+
+def _key_enabled(item: dict[str, Any]) -> bool:
+    value = item.get("enabled", True)
+    if isinstance(value, bool):
+        return value
+    return str(value).strip().lower() not in {"0", "false", "no", "off", "disabled"}

app/core/security/operation_guard.py

@@ -0,0 +1,16 @@
+from fastapi import HTTPException, status
+
+from app.core.config import get_settings
+
+
+READ_ONLY_OPERATION_DISABLED = "This service is read-only; data mutation operations are disabled"
+
+
+def require_operations_enabled(detail: str = READ_ONLY_OPERATION_DISABLED) -> None:
+    """Reject mutation-oriented endpoints when the product is running read-only."""
+
+    if get_settings().read_only_mode:
+        raise HTTPException(
+            status_code=status.HTTP_405_METHOD_NOT_ALLOWED,
+            detail=detail,
+        )